Pwn@Home An Attack Path to jailbreaking your home router

Recommendations

Info

Set-top-box Router Firmware Arbitrary code execution External library loading (1) package.loadlib(libname, funcname) Library loaded by dlopen() Fonction address resolved by dlsym() Only one argument of type lua_State * Load of existing library is useless Some folders are writeable (/tmp/, /media/hard drive/, etc.) But mounted with noexec option: syscall mmap() fail (flag PROT_EXEC)
Set-top-box Router Firmware Arbitrary code execution External library loading (2) ARMv5 architecture XN bit introduced by ARMv6 Modification of headers segment to remove executable flags Load of a library resulting in native code execution readelf –program-headers pwn.so Elf file type is DYN (Shared object file) Entry point 0x55c There are 4 program headers, starting at offset 52 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x000000 0x00000000 0x00000000 0x008cc 0x008cc R 0x8000 LOAD 0x0008cc 0x000088cc 0x000088cc 0x00124 0x0012c RW 0x8000 DYNAMIC 0x0008d8 0x000088d8 0x000088d8 0x000c8 0x000c8 RW 0x4 GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4
Page 1 and 2: Pwn@Home An Attack Path to jailbrea
Page 3 and 4: Set-top-box Router Firmware Context
Page 5 and 6: Set-top-box Router Firmware Targets
Page 7 and 8: Set-top-box Router Firmware Plan 1
Page 9: Set-top-box Router Firmware Code ex
Page 12 and 13: Set-top-box Router Firmware Code ex
Page 16 and 17: Set-top-box Router Firmware Chroot
Page 22 and 23: Set-top-box Router Firmware Plan 1
Page 32 and 33: Set-top-box Router Firmware Arbitra
Page 36 and 37: Set-top-box Router Firmware Arbitra
Page 45 and 46: Set-top-box Router Firmware Firmwar
Page 51 and 52: Set-top-box Router Firmware Kernel
Page 53 and 54: Set-top-box Router Firmware File sy
Page 55 and 56: Set-top-box Router Firmware Untethe
Page 57 and 58: Set-top-box Router Firmware Untethe
Page 59: Set-top-box Router Firmware Conclus

Pwn@Home An Attack Path to jailbreaking your home router

Create successful ePaper yourself

Delete template?

Save as template?